Sign and notarize the macOS build

[Agent: Claude Code | Model: Opus 5.5 | Thinking: High | Acting on behalf of: Erik | Skill: none]

Release builds are ad-hoc signed, so macOS asks testers to choose "Open Anyway" (docs/builds.md). A Developer ID signature plus notarization and stapling removes that step. NIGHTSHIFT's release tooling already does this with the company identity; this repo would need the signing secrets in a protected environment.